diff --git a/man/systemd-analyze.xml b/man/systemd-analyze.xml
index d3dfa9e526..e072d66131 100644
--- a/man/systemd-analyze.xml
+++ b/man/systemd-analyze.xml
@@ -1081,7 +1081,8 @@ Service b@0.service not loaded, b.socket cannot be started.
           normalized to the 1…100 range, and used to determine the overall exposure level of the unit.
           By allowing users to manipulate these fields, the 'security' verb gives them the option to
           decide for themself which ids are more important and hence should have a greater effect on
-          the exposure level.</para>
+          the exposure level. A weight of <literal>0</literal> means the setting will not be
+          checked.</para>
 
           <programlisting>
           {
diff --git a/src/analyze/analyze-security.c b/src/analyze/analyze-security.c
index 400eebbda8..d3e011e903 100644
--- a/src/analyze/analyze-security.c
+++ b/src/analyze/analyze-security.c
@@ -1764,6 +1764,11 @@ static int assess(const SecurityInfo *info,
                         d = strdup("Service runs in special boot phase, option is not appropriate");
                         if (!d)
                                 return log_oom();
+                } else if (weight == 0) {
+                        badness = UINT64_MAX;
+                        d = strdup("Option excluded by policy, skipping");
+                        if (!d)
+                                return log_oom();
                 } else {
                         r = a->assess(a, info, data, &badness, &d);
                         if (r < 0)
diff --git a/test/units/testsuite-65.sh b/test/units/testsuite-65.sh
index 64a7a34ed9..3218462c76 100755
--- a/test/units/testsuite-65.sh
+++ b/test/units/testsuite-65.sh
@@ -108,7 +108,7 @@ systemd-analyze security --threshold=90 --offline=true --root=/tmp/img/ testfile
 cat <<EOF >/tmp/testfile.json
 {"UserOrDynamicUser":
     {"description_bad": "Service runs as root user",
-    "weight": 2000,
+    "weight": 0,
     "range": 10
     },
 "SupplementaryGroups":